April 2025 Windows Update Disrupts Kerberos Authentication: Causes, Impacts, and Solutions

Overview

In April 2025, Microsoft released a security update aimed at addressing a critical vulnerability in Kerberos authentication, identified as CVE-2025-26647. This update, however, led to widespread authentication issues across various Windows Server environments, particularly affecting systems utilizing Windows Hello for Business (WHfB) and other certificate-based authentication methods.

Background on Kerberos and the Update

Kerberos is a network authentication protocol designed to provide strong authentication for client/server applications. It uses secret-key cryptography to enable secure communication over non-secure networks. In Windows environments, Kerberos is integral to Active Directory (AD) for authenticating users and services.

The vulnerability, CVE-2025-26647, involves improper input validation within the Windows Kerberos Key Distribution Center (KDC). An authenticated attacker could exploit this flaw by obtaining a certificate with a specific Subject Key Identifier (SKI) from a Certificate Authority (CA). This certificate could then be used to acquire a Ticket Granting Ticket (TGT) for a target user, potentially leading to privilege escalation.

To mitigate this vulnerability, Microsoft released security updates on April 8, 2025, which introduced stricter validation checks for certificates used in Kerberos authentication. Specifically, the updates enforced that certificates must chain to a root CA present in the NTAuth store. This change aimed to prevent unauthorized certificates from being trusted by the KDC.

Impact of the Update

The update impacted several Windows Server versions, including:

• Windows Server 2016
• Windows Server 2019
• Windows Server 2022
• Windows Server 2025

Post-update, organizations reported significant authentication failures, particularly in environments utilizing:

• Windows Hello for Business (WHfB) Key Trust: Users experienced logon failures due to the new certificate validation requirements.
• Device Public Key Authentication (Machine PKINIT): Systems relying on machine-based certificate authentication faced disruptions.
• Smart Card Authentication and Third-Party SSO Solutions: Products dependent on certificate-based logons encountered intermittent or consistent failures.

Administrators observed specific event logs indicating issues:

• Event ID 45: Logged when a client certificate did not chain to a root in the NTAuth store. This event served as a warning during the audit phase.
• Event ID 21: Logged when a client certificate was deemed invalid, resulting in failed smart card logons.

Technical Details

The update introduced a requirement for certificates used in Kerberos authentication to chain to a root CA in the NTAuth store. This validation ensures that only certificates from trusted CAs are accepted, mitigating the risk of unauthorized access.

Microsoft provided a registry key to control the enforcement of this new validation:

• Location: INLINECODE0
• Name: INLINECODE1
• Values:
  • INLINECODE2 : Disables the NTAuth check entirely.
  • INLINECODE3 : Enables NTAuth check and logs warning events (Audit mode).
  • INLINECODE4 : Enforces NTAuth check, denying logons if the certificate does not chain to the NTAuth store (Enforcement mode).

By default, if the registry key is not set, the system operates in Audit mode (INLINECODE5 ), logging warnings without denying authentication requests.

Mitigation Steps

To prevent authentication failures while maintaining security monitoring:

1. Set Registry Key to Audit Mode:

• Navigate to INLINECODE6 .
• Set INLINECODE7 to INLINECODE8 .

This configuration logs Event ID 45 for certificates not chaining to the NTAuth store but allows authentication to proceed.

1. Update NTAuth Store:

• Identify CAs issuing certificates used for authentication.
• Ensure these CAs' root certificates are added to the NTAuth store using the command:

``INLINECODE9 `INLINECODE10 AllowNtAuthPolicyBypassINLINECODE11 2` to enforce the NTAuth check.

Conclusion

The April 2025 security update underscores the delicate balance between enhancing security and maintaining operational stability. While the update addresses a critical vulnerability in Kerberos authentication, it also introduces challenges for systems relying on certificate-based authentication. Organizations must take proactive steps to update their NTAuth stores and monitor authentication processes to ensure a secure and functional environment.